Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,548 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects specific hash matches of the Atomic macOS Stealer (AMOS) Mach-O binary payloads (arm64/x86_64), which are associated with the Macfinger 'ClickFix' distribution chain.
Detects specific hash matches of the Atomic macOS Stealer (AMOS) Mach-O binary payloads (arm64/x86_64), which are associated with the Macfinger 'ClickFix' distribution chain.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects network traffic associated with AMOS (Atomic macOS) Stealer malware, identifying C2 beaconing and tasking requests. The rules specifically monitor POST requests to '/api/t' with JSON payloads and GET requests to '/api/shell/agent' over non-standard ports (excluding 80 and 443).
Detects HTTP GET requests to external URIs matching a specific pattern (a 10-20 character hexadecimal path followed by ?force=1), which is characteristic of the delivery or staging mechanism used by MacStealer (Macfinger) and Atomic macOS Stealer (AMOS) malware families.
Detects network traffic associated with the 'ClickFix' technique, where malicious websites masquerade as legitimate CAPTCHA or bot-protection services to exfiltrate visitor telemetry via POST requests or fetch malicious script overlays.
Detects outbound network traffic matching TLS SNI patterns associated with the Sauron Loader malware, indicating command-and-control (C2) communication. The rule monitors for frequent connections to specific domains (namsb-show, quinlantours, virtual-magic, lahaina-shores) following a defined threshold.
This rule detects the two-stage network behavior of AMOS (Atomic macOS Stealer). First, it identifies the initial C2 registration beaconing to an '/api/t' endpoint. Subsequently, it monitors for an immediate follow-up TLS connection to 'ipinfo.io', which is commonly used by the malware for geolocation and victim system reconnaissance.
Detects multiple HTTP POST requests to a specific credential-related API path (/api/credentials) directed at an external IP address (95.163.153.80) on a non-standard port (8133). This pattern is indicative of potential automated credential exfiltration or brute-force activity.
Page 370 of 1168